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Abstract 



Whether the class QMA (Quantum Merlin Arthur) is equal to QMA 1; or QMA with one- 
sided error, has been an open problem for years. This note helps to explain why the problem 
is difficult, by using ideas from real analysis to give a "quantum oracle" relative to which 
QMA ^ QMA!. As a byproduct, we find that there are facts about quantum complexity 
classes that are classically relativizing but not quantumly relativizing, among them such "trivial" 
containments as BQP C ZQEXP. 

1 Introduction 

The complexity class MA (Merlin-Arthur) was introduced by Babai [3] in 1985. Intuitively, MA 
is a probabilistic version of NP; it contains all problems for which an omniscient wizard Merlin 
can convince a probabilistic polynomial-time verifier Arthur of a "yes" answer, by a one-round 
protocol in which Merlin sends Arthur a purported proof z, and then Arthur checks z. In the 
usual definition, if the answer to the problem is "yes" then there should exist a string z that makes 
Arthur accept with probability at least 2/3 (this property is called completeness), while if the 
answer is "no" then no z should make Arthur accept with probability more than 1/3 (this property 
is called soundness). 

One of the first questions people asked about MA was whether it can be made to have perfect 
completeness (also called one-sided error): that is, whether the 2/3 in the above definition can 
be replaced by 1. In other words, can we assume without loss of generality that Arthur never 
rejects a valid proof? This question was answered in the affirmative by Zachos and Fiirer [15], 
using a technique introduced earlier by Lautemann [12] to show BPP C (for a different proof 
see Goldreich and Zuckerman [9]). 

A decade ago, Kitaev [10] and Watrous [J5] introduced a quantum analogue of MA, called QMA 
(Quantum Merlin Arthur). Loosely speaking, QMA is the same as MA, except that the verifier 
Arthur is a polynomial-time quantum algorithm, and the proof sent by Merlin is a quantum state 
\if>) with polynomially many qubits. We know a reasonable amount about QMA (see Aharonov 
and Naveh [2j for a survey). Like MA, for example, QMA allows exponential amplification of com- 
pleteness and soundness [13J, is contained in PP [13J, and has natural complete promise problems 

However, the question of whether QMA can be made to have perfect completeness has resisted 
attack. At first a mere nuisance, this question has increasingly cropped up in quantum complexity 
theory. For example, two years ago Bravyi [8] defined a quantum analogue of the A;-SAT problem, 
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and showed it complete for the complexity class QMAi, meaning QMA with one-sided error. But 
showing quantum fc-SAT is QMA- complete would require further showing that QMAi = QMA, or 
equivalently, that QMA protocols can be made to have perfect completeness. What makes the 
situation even stranger is that, if we allow multiple rounds of interaction between the prover and 
verifier (yielding the class QIP), then quantum interactive proof systems can be made to have 
perfect completeness [TT] . 

In this note we help explain this puzzling state of affairs, by giving a quantum oracle U relative 
to which QMA^ ^ QMA W . A quantum oracle, as defined by Aaronson and Kuperberg [T], is 
simply a unitary transformation on quantum states that can be applied in black-box fashion. Our 
result implies that there is no "black-box method" to convert QMA protocols into QMAi protocols, 
in the same sense that there are black-box methods to convert MA protocols into MAi protocols, 
and to convert QMA protocols into QMA protocols with exponentially small error. If a proof of 
QMAi = QMA exists, it will instead have to use "quantumly nonrelativizing techniques": techniques 
that are sensitive to the presence of quantum oracles. 

Somewhat surprisingly, our separation proof has almost nothing to do with complexity theory, 
and instead hinges on real analysis. Our oracle will act on just a single qubit, and will rotate that 
qubit by an angle 9 that is either or far from zero. We will show that any QMAi protocol to 
convince a time-bounded verifier that 0^0, using any finite-sized quantum proof, would lead to 
a matrix E {9) that depends analytically on 9, yet whose maximum eigenvalue has the "piecewise" 
behavior shown in Figure [TJ We will then use results from real analysis to show that this behavior 
cannot occur. 




o.o H 1 1 1 1 

1 2 

Figure 1: As we vary 9, the largest eigenvalue a (9) of the matrix E (9) must start out small, but 
then "plateau" at a (9) = 1. We will show that this contradicts the analyticity of E (9). 

Since our argument does not depend on the running time of the QMAi machine (so long as 
it is finite), the same argument will yield quantum oracles U such that BQP W (jL QMAi EX P w 
and even BQP W <f_ QMAiEEEXP". This, in turn, has a somewhat surprising implication: that 
quantum oracles can invalidate even complexity class containments that hold for "trivial" reasons 
in the unrelativized world. In particular, we will argue that there are extremely simple proof 
techniques — including the representation of quantum amplitudes by explicit sequences of bits — that 
are classically relativizing but not quantumly relativizing (at least when applied to one-sided-error 
complexity classes). Unfortunately, knowing this does not by itself seem to help in finding a proof 
that QMA X = QMA. 
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Some argue that any quantum complexity class involving perfect completeness is "inherently 
unphysical," and we do not wish to dispute this. Indeed, our results could even be taken as further 
evidence for this point of view. On the other hand, classes like QIP and QMA could also be seen 
as "unphysical" (since there are no Merlins), yet few quantum computing researchers would deny 
that their study has led to major insights. On a related topic, let us stress that our result does 
not depend on restricting the set of gates available to the QMAi machine: it works assuming any 
countable set of gates. The key issue, then, is not any limitation of the gate basis, but simply the 
underlying requirement of perfect completeness. 

The rest of the paper is organized as follows. Section [2] reviews some preliminaries from 
complexity theory and real analysis, Section [3] proves the main result, Section [4] discusses the 
implications for quantum oracles, and Section [5] concludes with some extensions and open problems. 

2 Preliminaries 

In what follows, we assume familiarity with standard complexity classes such as QMA and MA. See 
the Complexity Zoo3 for definitions. For completeness, we now define the class QMAi, or QMA 
with one-sided error. 

Definition 1 A language L C {0, 1}* is in QMAi if there exists a uniform polynomial- size quantum 
circuit family {C n } n>1 , and a polynomial p, such that for all inputs x G {0, l} n : 

• (Perfect Completeness) If x G L, then there exists a p(n)-qubit quantum witness \ip) such 
that C n (x, \ip)) accepts with certainty. 

• (Constant Soundness) If x ^ L, then C n {x, \(p)) accepts with probability at most 1/2 for all 

\<P)- 

One can similarly define MAi as the class of languages L for which there exists a randomized 
polynomial-time algorithm A such that for all inputs x G {0, 1}", if x G L then there exists a witness 
w G {0, l} p( - n ) such that A (x, w) accepts with certainty, while if x ^ L then A (x, w) accepts with 
probability at most 1/2 for all w. As mentioned before, the result of Zachos and Fiirer [15] implies 
that MAi = MA, whereas we do not know whether QMAi = QMA. 

Note that, because of the perfect completeness condition, the definition of QMAi might depend 
on the particular basis of gates used to generate C n . Indeed, the natural way to show that QMAi 
does not depend of the basis of gates would presumably be to show that QMAi = QMA, the 
very task for which we are pointing out an obstacle! For our purposes, though, we can take any 
countable set of 1- and 2-qubit gates as the gate basis of the QMAi machine, regardless of how 
many bits are needed to describe those gates. For example, we could take the set of all 1- and 
2-qubit gates that are computably describable. Our separation results will still go through, and 
such an assumption can only make our results stronger. (Furthermore, the only reason the gate 
basis needs to be countable is so that a diagonalization argument will go through. If the quantum 
oracle U could be chosen subsequent to the choice of QMAi machine, then we could even handle 1- 
and 2-qubit gates with arbitrary complex- valued transition probabilities.) 

Following Aaronson and Kuperberg pQ, we define a quantum oracle U to be simply a collection 
of unitary operations {U n } n>1 , where each U n acts on some number of qubits q (n) (in this note 

1 http://www.complexityzoo.com 
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q (n) will always be 1). Let C be a quantum complexity class. Then by C w , we mean the class 
of problems solvable by a C machine that can, at any time step, apply any U n € IA to any subset 
of its qubits at unit cost. While this is admittedly an informal definition, for any C of interest to 
us it is easy to give a reasonable formalization. While there are ambiguities in defining C w , none 
of those ambiguities will turn out to matter for us. For example, we can assume (if we like) that 
a C u machine is also able to apply U^ 1 and contr oiled- U n , possibly with different values of n in 
different branches of a superposition. None of these decisions will affect our results. 

We now turn to reviewing some facts from real analysis. Recall that a function / : R — > R is 
called real analytic if for every xq £ R, the Taylor series about x$ is convergent and equal to / (x) 
for all x close enough to xq. Every real analytic function is smooth, but the converse does not 
hold. 

We will need the following theorem of Alekseevsky et al. (Theorem 5.1 in [3]): 
Theorem 2 ([3]) Let 

p (9) (x) = b {9) + h (9) x + b 2 {9)x 2 + --- + b N {9) x N 

be a real polynomial in x with all real roots, parameterized by 6 E R. Suppose the coefficients 
bo (ff) , . . . ,6jv {9) o,re all real analytic functions of 9. Then there exist real analytic functions 
Ai (9) , . . . , Ajv (9) such that {Ai (9) , . . . , X N (9)} is the set of roots of p{9) (x) for all 9 G R. 

We also need the following basic fact: 

Proposition 3 Let f : R — ► R be a real analytic function. If there exists an open set (x, y) C R 
on which f is constant, then f is constant everywhere. 

Note that Proposition [3] is false with smooth functions in place of real analytic onesH This is 
why we need analyticity for our result. 

3 Result 

We first need a more-or-less standard fact (proved for completeness), which recasts the problem of 
finding an optimal QMA witness as a principal eigenvalue problem. 

Lemma 4 Let V be a quantum verifier that takes as input a Q-qubit quantum witness \ip), and 
that makes T queries to a quantum oracle described by a unitary matrix U . Also, let a (U) be 
the acceptance probability of V u maximized over all possible \cp). Then there exists a 2® x 2^ 
complex-valued matrix E (U) such that 

(i) Every entry of E (JJ) is a polynomial in the entries of U , of degree at most 2T . 

(ii) E (U) is Hermitian for all U . 

(Hi) a{U) equals the largest eigenvalue of E(U), for all U. 

2 The standard counterexample is / (x) — for x < and / (x) = e~ 1 ^ x for x > 0. 
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Proof. Let a(U, \tp)) be the acceptance probability of V u on input \ip). Then clearly there exist 
vectors (not necessarily normalized, and depending on U) such that 

«([/») = ^T|<^>| 2 . 

i 

Furthermore, by an observation of Beals et al. [5], every entry of every must be a polynomial in 
the entries of U, of degree at most T. (This is because initially the entries are degree-0 polynomials, 
and every query to the oracle can increase the degree by at most 1.) So if we set E := ^ \vj) (vi\, 
then E is a 2^ x 2^ Hermitian matrix, every entry of which is a polynomial of degree at most 2T. 
Furthermore a(U, \ip)) = (<p\E\<p), which implies that 

a (U) = max a (U, \<p)) = max (ip\E\ip) 
\<p) \<p) 

which is just the largest eigenvalue of E. ■ 
We now prove the main result. 

Theorem 5 There exists a quantum oracle U such that QMA^ ^ QMA W . 

Proof. Let 9 be a real number, and let U = U (9) be the one-qubit unitary transformation 

/ cos 9 — sin 9 \ 
\ sin 9 cos 9 J 

Given oracle access to U, we consider the problem of deciding whether 9 = (the NO case) or 
1 < 9 <2 (the YES case), promised that one of these holds. Of course this problem is easily solved 
by a quantum computer, with bounded error probability, using O (1) queries to U. On the other 
hand, we will show that this problem does not admit a perfect-completeness QMA protocol, with 
any finite number of queries to U and any finite-sized quantum proof. 

To see this, let V be a verifier, let T be the number of queries that V makes to U, and let Q 
be the number of qubits in V's quantum witness. Also, let a (9) be the acceptance probability of 
V assuming U = U (9), maximized over all Q"Q u bit quantum witnesses \tp). Then by Lemma [H 
there exists a 2® x 2^ complex-valued matrix E (9) such that 

(i) Every entry of E (9) is a polynomial in cos 9 and s'm9, of degree at most 2T. 

(ii) E (9) is Hermitian for all 9 £ R. 

(iii) a (9) equals the largest eigenvalue of E (9), for all 9 £ R. 

Let N = 2 Q , and let X 1 (9),...,X N (9) be the eigenvalues of E (9). Then the \ (0)'s are roots 
of a degree- N characteristic polynomial parameterized by 9: 

p (9) (x) = b (9) + bi (9) x + b 2 (9)x 2 + --- + b N (9) x N . 

Each coefficient bj (9) is a polynomial in the entries of E (9) of degree at most N, and hence, by (i), 
a polynomial in cos 9 and sin 9 of degree at most 2TN. By (ii), the Aj (0)'s are all real, and therefore 
the bj (0)'s must be real as well for all 9. Combining these facts, we find that each bj (9) is a real 
analytic function of 9 (for note that cos 9 and sin# are real analytic functions, and real analytic 
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functions are closed under composition). By Theorem [21 then, we can take Ai (#),..., Atv (#) to 
be real analytic functions as well. 

By (hi), the acceptance probability a (8) of V (maximized over all witnesses) is equal to 
maxjAj(0). If V is a valid QMAi verifier, then we must have a (0) < 1/2, but a(8) = 1 for 
all real 1 < 8 < 2. Since N is finite and the Aj (#)'s are continuous, this implies that there exists 
an i G [N] such that Aj (0) < 1/2, but Aj (8) = 1 for all 8 in some open interval (x, y) C [1, 2]. But 
this contradicts the analyticity of Aj by Proposition [3l Hence there must be a choice of 8 such that 
V does not solve the problem correctly given U = U (8) as oracle. 

We now simply diagonalize over all n to achieve the desired oracle separation. More formally, 
let U be a collection of quantum oracles U\, U2, ■ ■ ., such that U n = U (8 n ) rotates by the angle 
$n G {0} U [1, 2]. Also, let L be a unary language such that 0™ G L if and only if 8 n ^ 0. Then 
clearly L G BQP W , and hence L G QMA W , for all choices of 14. On the other hand, we claim that 
U can be chosen so that L ^ QMA^. To see this, let M±,M2, ... be an enumeration of QMAi 
machines. Then for each i, we simply choose an rii so large that U ni cannot have been queried 
by machines Mi, . . . , Afj—i, and then set 8 ni so that Mj fails on input ni . (In other words, either 
8 ni = and there exists a witness \(p) causing Mj to accept with probability greater than 1/2, or 
else 8 ni G [1, 2] and no witness causes Mi to accept with probability 1.) This is clearly possible by 
the argument above. ■ 

Notice that the proof of Theorem [5] breaks down if either T (the number of queries to the 
unitary U) or Q (the size of the witness) is infinite. This is not an accident. If T is infinite, 
then a quantum algorithm can determine 8 exactly, with no need for a witness. If Q is infinite, 
then the witness \ip) can describe 8 to infinite precision, and verifying the description (with perfect 
completeness) requires just a single query to U. 

4 Discussion 

Perhaps the strangest aspect of Theorem [5] is its lack of dependence on the polynomial running 
time of the QMAi machine. For example, the same argument gives a quantum oracle U such 
that BQP" (f_ QMAiEXP", where QMAi EXP is the exponential-time version of QMAi, an d even 
BQP W £ QMAiEEEXP". Indeed, just by using Proposition [3] about real analytic functions, without 
Lemma H] or the theorem of Alekseevsky et al. [3], one can construct a quantum oracle IA such that 
(for example) BQP W <f_ ZQEXP^, where ZQEXP is Zero-Error Quantum Exponential-TimeU 

What makes this strange is that we know, by trivial relativizing arguments, that BQP C EXP C 
ZQEXP. Reflecting on the apparent contradiction, one might suspect that the quantum oracle 
separations are "cheating" somehow. But this is not the case; the correct resolution is simply that 
results like BQP C ZQEXP, while classically relativizing, must be quantumly non-relativizing! But 
how could that be? 

If we carefully write out a proof that BQP C ZQEXP, we see what the problem is. Since ZQEXP 
is a zero-error class, the "obvious" proof will have to proceed not by direct simulation of the BQP 

3 If we just want to separate BQP from ZQP (Zero-Error Quantum Polynomial- Time), this can be done with an 
ordinary classical oracle. Indeed we can easily construct an oracle A such that BPP A <£_ ZQP A , by considering a 
problem where the answer is YES if A (y) = 1 for most y £ {0, 1}™, or NO if A (y) = for most y € {0, 1}™. Such a 
problem is trivially in BPP' 4 , but can be shown not to be in ZQP A using the polynomial method of Beals et al. [5]. 
It would be nice if the same trick gave us a classical oracle A such that BPP A <f_ QMA A , but of course it does not, 
since the result of Zachos and Fiirer [15] (which is relativizing) implies that BPP A C MA A = MA A C QMA A for all 
A. 
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machine, but by representing the amplitudes of the BQP machine in some explicit way. (In other 
words, by mimicking the proofs of containments such as BQP C EXP or BQP C PSPACE [7].) But 
the technique of explicitly representing amplitudes, simple though it seems, is already quantumly 
non-relativizing: it can break down if there is a quantum oracle U, some property of which must 
be decided without error! 

Some readers might conclude from this that quantum oracles are illegitimate; others, that the 
whole problem comes from the introduction of one-sided-error quantum complexity classes like 
QMAi. Our own view is that questions of "complexity-theoretic legitimacy" need to be decided 
on a case-by-case basis. In the present case, the real substance of our result is that any proof of 
QMAi = QMA will need to involve explicit representation of amplitudes (or something similar), 
rather than just black-box composition of quantum circuits. 

It remains a major challenge to find a quantumly non-relativizing technique that both (i) goes 
beyond the known classically non-relativizing techniques such as arithmetization, and (ii) fails to 
relativize even with two-sided-error complexity classes. 

5 Extensions and Open Problems 

By analogy to our quantum oracle separating QMAi from QMA, one might ask whether it is possible 
to construct a "randomized oracle" R separating MAi from MA0 This would show that the proof 
of MAi = MA due to Zachos and Fiirer [15] must have been "randomly non-relativizing." Indeed 
such a randomized oracle separation is possible: simply have R either output whenever it is 
queried (the NO case), or else output or 1 with equal probability (the YES case). It is obvious 
that these two cases can be distinguished by a BPP K machine, using O (1) queries to R. On the 
other hand, because of the perfect completeness requirement, the two cases cannot be distinguished 
by an MA^ machine: having a witness in support of the YES case clearly makes no difference. 

However, this classical counterpart of our result really does feel like cheating! With the ran- 
domized oracle, perfect completeness is unachievable for trivial information-theoretic reasons, even 
assuming an infinitely long MA witness. With the quantum oracle, by contrast, perfect complete- 
ness would be achievable, if there were only some way to specify 8 to infinite precision using the 
quantum witness \<p). This is of course what Theorem [5] rules out. 

The above discussion immediately suggests another question. In constructing the quantum 
oracle U, can we ensure that the angles 6 n are all rational numbers (or belong to some other dense 
countable set)? Indeed, the proof of Theorem [5] can easily be modified to achieve this. This is 
because of the following extension of Proposition [3j 

Proposition 6 Given a real analytic function f : R — ► R, if there exists an open set (x, y) C R 
such that f (z) = 1 for all rational points z G (x,y), then f (z) = 1 identically. 

However, there is an interesting difference between the real and rational cases. In the case 
where the # n 's are real, it is possible to construct a single quantum oracle U such that BQP W <£_ 
QMAiTIME (/ (riff 1 for all functions /. For example, choosing each 9 n to be with probability 

4 It is also interesting to see why a classical version of our argument does not yield an ordinary classical oracle A 
such that MAi 7^ MA A , thereby contradicting the result of Zachos and Fiirer [15] (which is relativizing). The answer 
turns out to involve the fact that in the classical case, Merlin can take advantage of the individual oracle bits, rather 
than just the total amplitude for a '1' outcome. To put it another way: in the classical case, there is no such thing 
as an oracle that is both continuous and deterministic. 
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1/2, or uniformly distributed in [1,2] with probability 1/2, will yield such a U with probability 1, 
by an argument due to Bennett and Gill [6]. In the rational case, such a strong separation is also 
achievable, but only by choosing the numerator and denominator of each rational number 6 n to 
grow faster than any computable function of n. If we sidestep the issue of computability, say by 
giving the function / (n) to the QMAiTIME (/ (n)) machine as advice, then it is not hard to show 
the following: 

Claim 7 Given any quantum oracle U = {U n } n>1 with rational angles {0 n } n>1 , there exists a 
function f such that BQP W is simulable by a zero-error quantum algorithm that makes f (n) queries 
to U. 

We end with two open problems. First, suppose the rotation angle n cannot assume a contin- 
uum of values, but only a large finite set of values S n . Is it then the case that either T must scale 
like ISVJ^ 1 ^ or Q must scale like J)(log|5 n |)? What is the optimal tradeoff between T and Ql 
Are quantum witnesses (in this setting) ever more powerful than classical witnesses of comparable 
size? 

Second, can we prove a classical oracle separation between QMAi and QMA? 
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